Configuring Protocol Order

By default, NNMi performs CRL checking, and then OCSP checking.

To configure the order in which the certificate validation protocols check for revoked certificates, do the following:

  1. Edit the following file:

    Windows: %NnmDataDir%\nmsas\NNM\conf\nms-auth-config.xml

    Linux:$NnmDataDir/nmsas/NNM/conf/nms-auth-config.xml

  2. Within the <revocation> section of the file (find the <revocation> tag), search for the line that begins with the following text:

    <ordering>
  3. Do one of the following:

    • To specify that CRL checking is to be used first, followed by OCSP, edit the line to read as follows:

      <ordering>CRL OCSP</ordering>
    • To specify that OCSP checking is to be used first, followed by CRL, edit the line to read as follows:

      <ordering>OCSP CRL</ordering>
  4. Save the nms-auth-config.xml file.
  5. Run the following command for the change to take effect:

    nnmsecurity.ovpl -reloadAuthConfig